Watch Out for The “Verification Code” Call

A scam that's been making the rounds lately uses Klarna as the hook — but the same trick works with banks, payment apps, retailers, and email accounts. If you've ever gotten a call asking you to read back a verification code from a text, this is what's happening, and the small habit that protects you no matter who's on the line. 

How the call usually goes

We'll use Klarna as the example, but swap in any company you have an account with and the script is nearly identical.

The caller says they're from Klarna, there's been suspicious activity on your account, a charge they want to help you stop, or a deal they want to help you get in on. To "verify it's really you," they say they're sending a code, and seconds later a text from Klarna arrives with a real 6-digit code. They ask you to read it back.

Most people would. The text looks genuine because it is — Klarna actually sent it. What the caller doesn't mention is that they triggered it, by entering your phone number or email into Klarna's real login screen. That code is what's keeping them out of your account. Reading it aloud is what lets them in.

This is classic phishing. The same setup works whether the caller is pretending to be your bank ("we're seeing a wire transfer go through right now"), Amazon ("there's a $1,200 order on your account"), or Apple ("someone is trying to access your iCloud"). The company's name changes. The trick doesn't.

The one rule that stops it

A verification code is meant to be typed by you, into a screen, not spoken to anyone, even someone who sounds official or genuinely worried about you.

Klarna says this plainly: they will never call you and ask for a one-time code, and they never ask for passwords or account information by phone, email, or text. The same is true of any legitimate company like your bank, your payment apps, Amazon, Apple, Microsoft. If a caller asks for any of those things, that alone is a big red flag.

What to do

If a call like this happens, you can simply hang up.  You don't owe a stranger an explanation. If part of you wonders whether the call might have been real, that's understandable. The safest way to check is to open the company's app yourself, or type their address into your browser directly. Don't call back the number that just called you, and don't click any link the caller sent.

If you did read out a code before realizing what was happening, take a breath,  this happens to a lot of people. Sign in to that account, change your password, review recent activity, and report it to the company through their official fraud channels. You can also report it to the FTC at reportfraud.ftc.gov. Acting quickly helps, but it's worth doing even if some time has already passed.

For families

If you help a parent or older loved one with finances, you can save them real stress by mentioning this kind of call before it happens. Keep it light: "If anyone ever calls and asks you to read back a code from a text, just hang up no matter who they say they are." A simple rule from someone they trust tends to stick longer than a list of warnings.

And if a loved one has already been caught by something like this, please lead with care, not frustration. These scams are built to fool sharp people. Helping them lock down the account without making them feel foolish is also what makes them more likely to tell you the next time something feels off.

‍

By learning what’s normal for you, Carefull can flag when something doesn’t look right—helping catch scams like this before damage is done. 

‍